Cisco fixes Security Manager vulnerabilities with public exploits

Cisco has released security updates to address multiple pre-authentication vulnerabilities with public exploits affecting Cisco Security Manager that could allow for remote code execution after successful exploitation.

Cisco Security Manager helps manage security policies on a large assortment of Cisco security and network devices, and it also provides summarized reports and security event troubleshooting capabilities.

This product works with a wide array of Cisco security appliances including but not limited to Cisco ASA appliances, Cisco Catalyst 6000 Series Switches, Integrated Services Routers (ISRs), and Firewall Services modules.

Proof-of-concept exploits available since November

"The Cisco Product Security Incident Response Team (PSIRT) is aware of public announcements about these vulnerabilities," the advisory says.

These vulnerabilities impact Cisco Security Manager releases 4.22 and earlier and they were disclosed by Cisco on November 16, after being reported by Code White security researcher Florian Hauser in August. 

Hauser shared proof-of-concept exploits for all 12 Cisco Security Manager vulnerabilities he reported after Cisco PSIRT stopped responding.

Luckily, at the moment, Cisco says that they are not aware of any ongoing attacks exploiting the vulnerabilities patched today.

"Cisco PSIRT is not aware of malicious use of the vulnerabilities that are described in this advisory," Cisco adds.

Security updates available

Cisco addressed two of the 12 vulnerabilities (CVE-2020-27125 and CVE-2020-27130) but didn't provide any security updates to fix multiple security bugs, collectively tracked as CVE-2020-27131.

The vulnerabilities were found by Hauser in the Java deserialization function in Cisco Security Manager and are caused by "insecure deserialization of user-supplied content by the affected software."

Cisco released the missing patches for CVE-2020-27131 in Servicepack 4.22SP1. Patch now!

— frycos (@frycos) December 7, 2020

Following successful exploitation, they could allow unauthenticated attackers to execute arbitrary commands remotely on vulnerable devices.

"An attacker could exploit these vulnerabilities by sending a malicious serialized Java object to a specific listener on an affected system," Cisco explains.

"A successful exploit could allow the attacker to execute arbitrary commands on the device with the privileges of NT AUTHORITY\SYSTEM on the Windows target host."

Cisco has fixed these vulnerabilities in Cisco Security Manager Release 4.22 Service Pack 1.

Admins should immediately deploy the security update as soon as possible given that there are no workarounds that address these security bugs.

In November, Cisco also disclosed an AnyConnect VPN zero-day bug with public exploits affecting software with non-default configurations.